Kaynağa Gözat

qcacld-3.0: Avoid use after free in csr_post_rso_stop

Req has been freed in csr_roam_send_rso_cmd when post msg failed.
Avoid use after free and double free in csr_post_rso_stop.

Change-Id: I86e6360eed1a57d0bac218f799393fff0e2a4a58
CRs-Fixed: 2748399
jianmin 4 yıl önce
ebeveyn
işleme
f5951e0c42
1 değiştirilmiş dosya ile 0 ekleme ve 2 silme
  1. 0 2
      core/sme/src/csr/csr_api_roam.c

+ 0 - 2
core/sme/src/csr/csr_api_roam.c

@@ -18569,8 +18569,6 @@ csr_post_rso_stop(struct mac_context *mac, uint8_t vdev_id, uint16_t reason)
 	status = csr_roam_send_rso_cmd(mac, vdev_id, req);
 	if (QDF_IS_STATUS_ERROR(status)) {
 		sme_err("ROAM: Post RSO stop failed, vdev_id: %d", vdev_id);
-		qdf_mem_zero(req, sizeof(*req));
-		qdf_mem_free(req);
 		return QDF_STATUS_E_FAULT;
 	}
 	roam_info->last_sent_cmd = ROAM_SCAN_OFFLOAD_STOP;